Bug 2189376

Summary: gnome-remote-desktop cannot be connected to with Windows 10 and Windows 11 RDP client, CredSSP error
Product: [Fedora] Fedora Reporter: Adam Baxter <fedora>
Component: gnome-remote-desktopAssignee: Jonas Ådahl <jadahl>
Status: CLOSED EOL QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 38CC: garrett.mitchener, gnome-sig, jadahl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2024-05-21 14:43:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Adam Baxter 2023-04-25 03:19:51 UTC
Error from Windows side is 
An authentication error has occurred.
The token supplied to the function is invalid

I cannot see anything in journalctl.

A packet capture from the Windows side shows failureCode: Server requires Enhanced RDP Security with CredSSP (0x00000005)


Windows is requesting 0x00000001, TLS security supported
TLS security supported: True
CredSSP supported: False

Reproducible: Always

Steps to Reproduce:
1. Tick screen sharing in Gnome Settings on a new Fedora 38 install
2. Try to connect (via hostname?) using Windows 10 mstsc
3. Error.

Comment 1 Garrett Mitchener 2023-12-05 13:45:33 UTC
Possibly related: https://bugs.launchpad.net/ubuntu/+bug/1970924

Comment 2 Garrett Mitchener 2023-12-05 13:58:08 UTC
Posiibly related: https://bugzilla.redhat.com/show_bug.cgi?id=2127469

Comment 3 Adam Baxter 2024-01-01 10:23:31 UTC
I'm back, it's 2024 and I'm connecting from Windows 11 23H2 to Fedora 39

```
voltagex@framework:~$ journalctl -x | grep gnome-remote-desktop-daemon #Is there an easier command for this?
Jan 01 20:49:18 framework gnome-remote-desktop-daemon[3922]: Cannot load libcuda.so.1
Jan 01 20:49:18 framework gnome-remote-desktop-daemon[3922]: Cannot load libnvidia-encode.so.1
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:193] [3922:3968] [WARN][com.winpr.negotiate] - AcceptSecurityContext status SEC_I_CONTINUE_NEEDED [0x00090312]
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:198] [3922:3968] [WARN][com.winpr.negotiate] - AcceptSecurityContext status SEC_I_COMPLETE_NEEDED [0x00090313]
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:199] [3922:3968] [ERROR][com.winpr.sspi.NTLM] - Error: Could not find user in SAM database
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:199] [3922:3968] [WARN][com.winpr.sspi] - CompleteAuthToken status SEC_E_INTERNAL_ERROR [0x80090304]
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:199] [3922:3968] [WARN][com.freerdp.core.nla] - CompleteAuthToken status SEC_E_INTERNAL_ERROR [0x80090304]
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:199] [3922:3968] [ERROR][com.freerdp.core.transport] - client authentication failure
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:199] [3922:3968] [ERROR][com.freerdp.core.peer] - peer_recv_callback: CONNECTION_STATE_INITIAL - rdp_server_accept_nego() fail
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:199] [3922:3968] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:224] [3922:3990] [ERROR][com.freerdp.core.transport] - BIO_read returned a system error 0: Success
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:225] [3922:3990] [ERROR][com.freerdp.core] - transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:243] [3922:4008] [WARN][com.freerdp.core.connection] - server supports only NLA Security
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:243] [3922:4008] [ERROR][com.freerdp.core.connection] - Protocol security negotiation failure
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:244] [3922:4008] [ERROR][com.freerdp.core.peer] - peer_recv_callback: CONNECTION_STATE_INITIAL - rdp_server_accept_nego() fail
Jan 01 20:49:43 framework gnome-remote-desktop-daemon[3922]: [20:49:43:244] [3922:4008] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1
Jan 01 20:50:14 framework gnome-remote-desktop-daemon[3922]: [20:50:14:533] [3922:4060] [ERROR][com.freerdp.core.transport] - BIO_read returned a system error 0: Success
Jan 01 20:50:14 framework gnome-remote-desktop-daemon[3922]: [20:50:14:533] [3922:4060] [ERROR][com.freerdp.core] - transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:477] [3922:4042] [WARN][com.winpr.negotiate] - AcceptSecurityContext status SEC_I_CONTINUE_NEEDED [0x00090312]
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:482] [3922:4042] [WARN][com.winpr.negotiate] - AcceptSecurityContext status SEC_I_COMPLETE_NEEDED [0x00090313]
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:482] [3922:4042] [ERROR][com.winpr.sspi.NTLM] - Error: Could not find user in SAM database
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:482] [3922:4042] [WARN][com.winpr.sspi] - CompleteAuthToken status SEC_E_INTERNAL_ERROR [0x80090304]
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:482] [3922:4042] [WARN][com.freerdp.core.nla] - CompleteAuthToken status SEC_E_INTERNAL_ERROR [0x80090304]
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:482] [3922:4042] [ERROR][com.freerdp.core.transport] - client authentication failure
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:482] [3922:4042] [ERROR][com.freerdp.core.peer] - peer_recv_callback: CONNECTION_STATE_INITIAL - rdp_server_accept_nego() fail
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:482] [3922:4042] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:501] [3922:4078] [WARN][com.freerdp.core.connection] - server supports only NLA Security
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:501] [3922:4078] [ERROR][com.freerdp.core.connection] - Protocol security negotiation failure
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:504] [3922:4096] [ERROR][com.freerdp.core.transport] - BIO_read returned a system error 0: Success
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:504] [3922:4096] [ERROR][com.freerdp.core] - transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:504] [3922:4078] [ERROR][com.freerdp.core.peer] - peer_recv_callback: CONNECTION_STATE_INITIAL - rdp_server_accept_nego() fail
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:504] [3922:4078] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:504] [3922:3922] [ERROR][com.freerdp.core.transport] - BIO_should_retry returned an error: error:0A000197:SSL routines::shutdown while in init
Jan 01 20:50:20 framework gnome-remote-desktop-daemon[3922]: [20:50:20:504] [3922:3922] [ERROR][com.freerdp.core.transport] - BIO_should_retry returned an error: error:0A000197:SSL routines::shutdown while in init

```

From the Windows side:

```
[Window Title]
Remote Desktop Connection

[Content]
An authentication error has occurred.
The token supplied to the function is invalid

Remote computer: framework

[^] Hide details  [OK]

[Expanded Information]
Error code: 0x0
Extended error code: 0x0
Timestamp (UTC): 01/01/24 10:20:04 AM
Activity ID: 2224e1e3-4bd1-49c3-9866-2342911a0500

Press Ctrl+C to copy.
```
```

Comment 4 Roscoe Battles 2024-03-18 01:21:25 UTC Comment hidden (spam)
Comment 5 Aoife Moloney 2024-05-07 16:11:09 UTC
This message is a reminder that Fedora Linux 38 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 38 on 2024-05-21.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '38'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version. Note that the version field may be hidden.
Click the "Show advanced fields" button if you do not see it.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 38 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.

Comment 6 Adam Baxter 2024-05-12 11:32:04 UTC
Hi,
I have confirmed that this bug is still affecting Fedora 40, and as I reported previously it was also affecting 39.

Could you please update the versions? This bug should not be closed as EOL

Comment 7 Aoife Moloney 2024-05-21 14:43:37 UTC
Fedora Linux 38 entered end-of-life (EOL) status on 2024-05-21.

Fedora Linux 38 is no longer maintained, which means that it
will not receive any further security or bug fix updates. As a result we
are closing this bug.

If you can reproduce this bug against a currently maintained version of Fedora Linux
please feel free to reopen this bug against that version. Note that the version
field may be hidden. Click the "Show advanced fields" button if you do not see
the version field.

If you are unable to reopen this bug, please file a new report against an
active release.

Thank you for reporting this bug and we are sorry it could not be fixed.

Comment 8 Gene McGowan 2024-10-30 06:36:49 UTC Comment hidden (spam)